Description

The au_to_arg(), au_to_arg32(), and au_to_arg64() functions format the data in v into
an “argument token”. The n argument indicates the argument number. The text
argument is a null-terminated string describing the argument.

The au_to_attr() function formats the data pointed to by attr into a
“vnode attribute token”.

The au_to_cmd() function formats the data pointed to by argv into a
“command token”. A command token reflects a command and its parameters as
entered. For example, the pfexec(1) utility uses au_to_cmd() to record the command
and arguments it reads from the command line.

The au_to_data() function formats the data pointed to by p into an
“arbitrary data token”. The unit_print parameter determines the preferred display base of
the data and is one of AUP_BINARY, AUP_OCTAL, AUP_DECIMAL, AUP_HEX, or
AUP_STRING. The unit_type parameter defines the basic unit of data and
is one of AUR_BYTE, AUR_CHAR, AUR_SHORT, AUR_INT, or AUR_LONG. The
unit_count parameter specifies the number of basic data units to be used
and must be positive.

The au_to_groups() function formats the array of 16 integers pointed to by
groups into a “groups token”. The au_to_newgroups() function (see below) should be
used in place of this function.

The au_to_in_addr() function formats the data pointed to by internet_addr into
an “internet address token”.

The au_to_ipc() function formats the data in the id parameter into an
“interprocess communications ID token”.

The au_to_iport() function formats the data pointed to by iport into an
“ip port address token”.

The au_to_me() function collects audit information from the current process and creates
a “subject token” by calling au_to_subject().

The au_to_newgroups() function formats the array of n integers pointed to
by groups into a “newgroups token”. This function should be used in
place of au_to_groups().

The au_to_opaque() function formats the bytes bytes pointed to by data into
an “opaque token”. The value of size must be positive.

The au_to_path() function formats the path name pointed to by path into
a ``path token.''

The au_to_process() function formats an auid (audit user ID), an euid (effective
user ID), an egid (effective group ID), a ruid (real user ID),
a rgid (real group ID), a pid (process ID), an sid (audit
session ID), and a tid (audit terminal ID containing an IPv4 IP address),
into a “process token”. A process token should be used when
the process is the object of an action (ie. when the process
is the receiver of a signal). The au_to_process_ex() function (see below) should be
used in place of this function.

The au_to_process_ex() function formats an auid (audit user ID), an euid (effective
user ID), an egid (effective group ID), a ruid (real user ID),
a rgid (real group ID), a pid (process ID), an sid (audit
session ID), and a tid (audit terminal ID containing an IPv4 or IPv6 IP address), into a “process token”.
A process token should be used when the process is the object
of an action (that is, when the process is the receiver of
a signal). This function should be used in place of au_to_process().

The au_to_return(), au_to_return32(), and au_to_return64() functions format an error number number and
a return value value into a “return value token”.

The au_to_socket() function format the data pointed to by so into a
``socket token.''

The au_to_subject() function formats an auid (audit user ID), an euid (effective
user ID), an egid (effective group ID), a ruid (real user ID),
an rgid (real group ID), a pid (process ID), an sid (audit
session ID), an tid (audit terminal ID containing an IPv4 IP address), into
a “subject token”. The au_to_subject_ex() function (see below) should be used in
place of this function.

The au_to_subject_ex() function formats an auid (audit user ID), an euid (effective
user ID), an egid (effective group ID), a ruid (real user ID),
an rgid (real group ID), a pid (process ID), an sid (audit
session ID), an tid (audit terminal ID containing an IPv4 or IPv6 IP address), into a “subject token”. This function
should be used in place of au_to_subject().

The au_to_text() function formats the null-terminated string pointed to by text into
a “text token”.

Return Values

These functions return NULL if memory cannot be allocated to put the
resultant token into, or if an error in the input is detected.